Facebook Settles FTC Charges, Admits Mistakes

CEO Mark Zuckerberg promises to make Facebook a privacy leader.

(click image for larger view)

Slideshow: Top 15 Facebook Apps For Business

Facebook has agreed to settle Federal Trade Commission charges that it deceived consumers by telling them they could keep their personal information private while allowing that information to be shared and made public.

The proposed settlement requires Facebook to provide consumers with clear notice and to obtain consent when sharing information beyond the guidelines established by consumers' privacy settings. As with Google and its recent privacy settlement with the FTC, Facebook has agreed to have its privacy practices audited for the next 20 years.

CEO Mark Zuckerberg, in an effort to get out in front of yet another privacy controversy, Tuesday posted a contrite blog post in which he promises to make Facebook "the leader in transparency and control around privacy."

Insisting that Facebook has "a good history of providing transparency and control over who can see your information," Zuckerberg acknowledges his company's missteps.

"I'm the first to admit that we've made a bunch of mistakes," he wrote in his post. "In particular, I think that a small number of high profile mistakes, like Beacon four years ago and poor execution as we transitioned our privacy model two years ago, have often overshadowed much of the good work we've done."

As examples of that work, Zuckerberg cited 20 new tools and resources introduced in the past 18 months that have been designed to give users more control over the Facebook experience.

Of course it's not Facebook's good work that got the attention of the FTC. The FTC's complaint cites a series of promises about privacy that Facebook did not keep.

The broken promises include: a December 2009 website change that exposed information, such as Friends Lists, that had been designated private; Facebook's assertion that third-party apps would have only necessary information to operate, when in fact the apps had access to almost all of users' personal data; Facebook's assertion that users could restrict sharing to limited audiences, even though friends could share that information more broadly through third-party apps; Facebook's assertion that it would not share personal information with advertisers, which it nonetheless did; Facebook's claim that photos and videos from deleted accounts could not be accessed, which wasn't true; and Facebook's claim that it complied with the US-EU Safe Harbor Framework governing data transfers between the United States and Europe, with which it did not actually comply.

"Facebook is obligated to keep the promises about privacy that it makes to its hundreds of millions of users," said FTC chairman Jon Leibowitz in a statement. "Facebook's innovation does not have to come at the expense of consumer privacy. The FTC action will ensure it will not."

Maybe. The FTC's requirements will do nothing to prevent Facebook users from sharing without considering the implications; the FTC is powerless to protect users from themselves. But the agency has prompted Facebook to create two new privacy officer positions: chief privacy officer for policy, and chief privacy officer for products.

Zuckerberg insists that these two positions will help ensure that Facebook develops products and policies with privacy in mind.

Of course, merely creating a position does not guarantee that that position will have real power to affect important corporate decisions, or even that Facebook's conception of privacy will match consumer expectations.

Google's global privacy counsel Peter Fleischer last week noted on his personal blog that European privacy laws are likely soon to be amended to require that companies have a data protection officer. "This will be a practical step forward for privacy," he notes. "But at the same time, it will be important to define what we're accountable for, internally and externally, especially in a field where the very notion of 'privacy' is highly subjective, and where the visions of what a privacy leader is supposed to do diverge dramatically, by country, by industry, and by function."

Facebook may well take privacy seriously, but like Google it also takes advertising revenue seriously. And as privacy advocate Christopher Soghoian recently noted, the business models of online advertising services are inherently in conflict with user privacy.

The Enterprise Connect conference program covers the full range of platforms, services, and applications that comprise modern communications and collaboration systems. It happens March 25-29 in Orlando, Fla. Find out more.

Bprince, in response to your comment... I still grade it pretty low. B at best...It's great that they've protected us inside of facebook, but there is still a big piece missing...This does noting to protect us against being tracked OUTSIDE of facebook. If interested I think this may be a good read for you http://www.abine.com/wordpress...

In response, I've come to understand that the only way to protect your privacy on Facebook is to not use Facebook. I also don't believe that Facebook will take steps to finally protect it's users privacy. There's no incentive for them to. If anything, introducing privacy settings that actually work would harm Facebooks digital advertising sales.

Sure, the FTC might be auditing Facebooks privacy things for the next 20 years (I wonder if Facebook is saving money as a result of that ruling somehow) and that sounds great on paper but, this is the FTC we're talking about and it's about as efficient as the rest of the government. I actually like the idea of the FTC controlling my privacy on Facebook even less than I like the idea of Facebook controlling it.

tl;dr - I don't believe anything Facebook says and don't trust the government/FTC to make better decisions than FB.

Published: 2015-03-03Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

Published: 2015-03-03** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none.

How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.